Alerting

Savedsearches logevent action: how to ensure all alerts are captured?

koshyk
Super Champion

folks, we had to do summary indexing of alerts created by savedsearches. This has been accomplished by logevent (Though its NOT well documented in splunk docs). I've used https://docs.splunk.com/Documentation/Splunk/8.2.2/RESTREF/RESTsearch to setup and the tokens are all working good.

The settings are like below

 

logevent.param.index: test
logevent.param.sourcetype: my_summary_index_st
logevent.param.event: $name$ $result.*$

 

BUT , only the FIRST alert is captured by the $result.*$ token.

Any idea how to ensure the entire events from the alert are captured?  (`$results.*$` is NOT working)

PS: I've put a feedback to the docs team to update all the parameters, but the docs are lacking a lot compared to the alert functionalities

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Combine your results into a single row

P.S. It is documented in a number of places that $result.*$ only gives access to the first result row in the set.

splunkreal
Motivator

Hello,

found out my scheduled logevent reports (saved searches) were only inserting one row.

I had to open search then save as alert and trigger on "each event"

This should be enhancement request / well documented 🙂

 

* If this helps, please upvote or accept solution if it solved *
0 Karma

koshyk
Super Champion

Unfortunately the savedsearch logic is not within our control but by client. Also it may impact other elements like webhook/emails etc. if the manipulation happens at search level.

 

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...